Stored Cross-Site Scripting Vulnerability in Spotlightr Plugin for WordPress

CVE-2024-11411

What is CVE-2024-11411?

CVE-2024-11411 is a severe vulnerability in the Spotlightr plugin for WordPress that enables stored Cross-Site Scripting (XSS). This vulnerability arises from inadequate input sanitization and output escaping on the user-supplied attributes of the 'spotlightr-v' shortcode. Authenticated attackers with contributor-level access can exploit this flaw to inject arbitrary web scripts into pages, which will execute when other users access the compromised content. All versions of the Spotlightr plugin up to and including 0.1.9 are affected, highlighting the critical need for timely updates to mitigate potential exploits.

References